Got a message from google that my site was spamming. Found remv.php more or less by accident. Found out what it did by commenting out the line that checks to see if you are from the allowed list of IP addresses (near the beginning). It gave remote browser access to my entire directory tree, modify any file, seemed like it might be able to change modification times. So I look through every file (and there are a lot). Peppered through the directories are php scripts disguised as other things (eg picture.php.jpgg, right under picture.jpg). Make sure you check your files! Did the reinstall thing.